The console is an important attack vector on an embedded product. You can use the TRUSTFENCE_CONSOLE set of macros to enhance the security of the console, adapting it to your specific product requirements. Digi Embedded Yocto allows you to configure the console in one of four modes:

  • Console enabled (default)

  • Console disabled, enabled with passphrase

  • Console disabled, enabled with GPIO

  • Console disabled

Disable the console

To completely disable the product’s console, both in the U-Boot bootloader and the Linux user space, use the following configuration in your project’s conf/local.conf:

conf/local.conf
INHERIT += "trustfence"
TRUSTFENCE_CONSOLE_DISABLE = "1"

This is the recommended configuration, and it provides the highest level of security.

Configure passphrase-enabled console

You can also configure the console to be enabled by a secure passphrase using the following configuration in your project’s conf/local.conf:

conf/local.conf
INHERIT += "trustfence"
TRUSTFENCE_CONSOLE_DISABLE = "1"
TRUSTFENCE_CONSOLE_PASSPHRASE_ENABLE = "my_secure_password"

With the above configuration, the system will boot with a silent console. However, if the passphrase is typed immediately after U-Boot starts the console will be enabled.

This option impacts the boot time. Specifically, two timeouts are used:

  • 2 seconds per key press: This means if more than 2 seconds passes and the user did not enter any key, U-Boot aborts the password reading and keeps on booting (without enabling the console). On any key press, this timeout is reset.

  • 10 seconds for the full password: That is, after 10 seconds (even if the user is still pressing keys) U-Boot will abort the password reading and boot without console. This is done to prevent denial of service (DoS) attacks and guarantee that the target will boot even if there is a continuous stream of input data in the serial port.

The passphrase is not stored in the device so it cannot be obtained by reverse engineering, but it could be compromised by a brute force attack.

Configure GPIO-enabled console

You can also configure the system to enable the console with a GPIO.

conf/local.conf
INHERIT += "trustfence"
TRUSTFENCE_CONSOLE_DISABLE = "1"
TRUSTFENCE_CONSOLE_GPIO_ENABLE = "<GPIO name>"

This is the least secure configuration. Physical access to the device will compromise the console access.

Define TRUSTFENCE_CONSOLE_GPIO_ENABLE macro with the GPIO that should be used to enable the console. The GPIO name is composed of the port and the pin number, for example:

GPIO bank=2, pin_number=5 ⇒ GPIO2_5.

Ensure the selected GPIO is configured with the correct IOMUX in U-Boot. For example, for GPIO2_5:

  1. Use the appropriate IOMUX macro from arch/arm/dts/imx6dl-pinfunc.h:

    MX6_PAD_NANDF_D5__GPIO2_IO05

When the selected GPIO is low, the console remains disabled; when it is high, the console is enabled. Define TRUSTFENCE_CONSOLE_GPIO_ENABLE_ACTIVE_LOW to set the console enable active level to low:

conf/local.conf
TRUSTFENCE_CONSOLE_GPIO_ENABLE_ACTIVE_LOW = "1"
TrustFence cannot be configured for both passphrase- and GPIO-enabled console. If both configuration options are present, TrustFence selects the passphrase-enabled console by default.